6800e76ac53d68c3576f2293f4447e93496b337ef447cb57be447149a0c4ebfd

General

Target

2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Size

2.7MB
MD5

07b1087127e38101002b049e95e1ddcf
SHA1

394702087a93e47a25f3610c096cdc82747224ca
SHA256

6800e76ac53d68c3576f2293f4447e93496b337ef447cb57be447149a0c4ebfd
SHA512

8e9d1e973d73164108b0a458060f7ec0e1bf24bb0d9186fa5cbf54f927de15a25d5995f66cf0d4fcc0e08703ca5b5d48221a63f53027ed7b91174b614beb6f58
SSDEEP

49152:9HHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4QaTGHQ89KFeMK:9nKdtWsM0r1QnxK4DKH30FeT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1196	681e6ce

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	62	223.5.5.5	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	171	223.5.5.5	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	196	114.114.114.114	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	282	114.114.114.114	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	1	114.114.114.114	1196	681e6ce
Destination IP	61	114.114.114.114	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	102	114.114.114.114	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	164	114.114.114.114	1196	681e6ce
Destination IP	198	223.5.5.5	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Destination IP	283	223.5.5.5	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\681e6ce	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_F61B1F59C39D3BA0EA8DE9893578D2FA	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	681e6ce
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_F61B1F59C39D3BA0EA8DE9893578D2FA	681e6ce

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1479d8	681e6ce
File opened for modification	C:\Windows\4677a8	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	681e6ce

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	681e6ce
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	681e6ce
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	681e6ce
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	681e6ce
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	681e6ce
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	681e6ce
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	681e6ce
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	681e6ce
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	681e6ce

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1196	681e6ce
1196	681e6ce
1196	681e6ce
1196	681e6ce
1196	681e6ce
1196	681e6ce
1196	681e6ce
1196	681e6ce
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Token: SeTcbPrivilege	4116	2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Token: SeDebugPrivilege	1196	681e6ce
Token: SeTcbPrivilege	1196	681e6ce

C:\Users\Admin\AppData\Local\Temp\2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\Syswow64\681e6ce
C:\Windows\Syswow64\681e6ce
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\681e6ce

Filesize
2.7MB

MD5
ca60f67bc99db04bd37059e73ae29dc3

SHA1
717c52830ce724764d8e549aed5132f0230cdaf7

SHA256
ba2a80950a4db0b164b38a1b9c1081d7263f86a57d93992a40858d4a02fcf418

SHA512
c747ac83980e44608e95e898794b7923e5d6ec5d0cec34abd49e19a277426668f78ab559eaacec4cb3657edd7f1f730e9f74bf7a4ca9188529cd020b04ed903e

Download Submit
memory/1196-4-0x0000000000A10000-0x0000000000A73000-memory.dmp

Filesize
396KB

Download
memory/4116-0-0x00000000000D0000-0x0000000000133000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing